Critical Command-Line Option Injection Vulnerability in Python 3.12
Summary
ALSA-2026:6285: Important: python3.12 security update. Affects python3.12 versions < 3.12.12-4.el9_7.2. Fixed in 3.12.12-4.el9_7.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python 3.12 is an interpreted, interactive, object-oriented programming language that supports modules, classes, exceptions, and dynamic data types. It is widely used for web development, data analysis, artificial intelligence, and more. However, a recent security issue has been identified that affects the command-line options, potentially allowing attackers to inject malicious commands through crafted URLs.
Vulnerability Detail
The vulnerability arises from a command-line option injection in the webbrowser.open() function, which can be exploited via specially crafted URLs. This could allow an attacker to execute arbitrary commands on the system, leading to unauthorized access or data manipulation. The issue is tracked under CVE-2026-4519 and poses significant risks to applications relying on this functionality.
How To Fix
Minimum fixed version
3.12.12-4.el9_7.2
This is the first release that contains the fix.
sudo dnf update python3.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the webbrowser.open() function with untrusted URLs until the package is updated. Validate and sanitize any URLs before passing them to this function to mitigate the risk of command injection.
Conclusion
The command-line option injection vulnerability in Python 3.12 poses significant risks to applications that utilize the webbrowser.open() function. It is essential to update to the patched version to safeguard against potential exploitation. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for python3.12 →
FAQ
CVE-2026-4519 is a security vulnerability in Python 3.12 that allows command-line option injection through the webbrowser.open() function.
You can use Vulert, which monitors open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Exploitation of this vulnerability could lead to unauthorized command execution, data breaches, and potential system compromise.
Yes, a patch is available in version 3.12.12-4.el9_7.2 and later. It is recommended to update to this version to mitigate the risk.
You can use Vulert to receive real-time alerts for open-source vulnerabilities in your software, ensuring you are always informed about potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for python3.12.
